NWPINIONFacts before reflexes

Topic · 1 article

CI/CD security

Diagram of a GitHub Actions workflow change moving through GitHub classification to a pre-execution hold. A write-access collaborator can deny it without starting a runner or approve it, after which the job receives only its configured token permissions and exposed secrets.
Nowpinion's reconstruction of GitHub's documented hold. The automatic pause comes before runner execution; approval does not change the token permissions or secrets configured for the job.Original diagram: Nowpinion

analysis

GitHub Can Hold a Suspicious Workflow. The Approver Still Has to Read It

A new GitHub Actions control can stop certain public-repository runs before execution. The final boundary is a write-access human—and the credentials waiting after the click.